Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Only slightly related to this question, because it was discovered in the same scan:

Can someone explain how this happened?

When running netdiscover on my home network, my iPod Touch (identified by DHCP-reserved IP address and MAC address) responded to both its own IP address on our 10.x.x.x subnet and to 0.0.0.0 also. Why would this have happened?

EDIT: After letting netdiscover run awhile longer, it seems one of the PS3s on the network is also answering to 0.0.0.0 - why is this?

share|improve this question
    
Interesting. I'll leave this for someone who may know more about the internals of these devices, but I would suspect some virtual interface exists that is replying, and doesn't have an IP defined. Perhaps a part of uPNP/DLNA. –  Paul Nov 16 '11 at 1:37
    
Pretty sure uPNP is disabled on the PS3. Don't know if that's an option for the iPod. –  Iszi Nov 17 '11 at 18:54
    
Does netdiscover give you a mac address for the two IP addresses? Can you post them if so? –  Paul Nov 17 '11 at 20:51
    
The MAC addresses given at 0.0.0.0 are the same addresses that answer to the systems' regular IP. –  Iszi Nov 17 '11 at 20:56
    
I wonder if this has anything to do with Apple's Rapid DHCP. –  daxelrod Nov 18 '11 at 6:36

1 Answer 1

up vote 2 down vote accepted
+100

From the article 0.0.0.0 :

Computers normally show an address of 0.0.0.0 when they are not connected to a TCP/IP network. Having this address, a computer cannot be reached or communicate with any other devices over IP.

TCP/IP software applications also use 0.0.0.0 as a programming technique to monitor network traffic from any valid IP address. While connected computers do not use this address, messages carried over IP sometimes include 0.0.0.0 inside the header when the source of the message is unknown.

Citing also from this thread :

The IP address 0.0.0.0 can have very different meanings, depending on where it's used.

  • It's not a valid address to be given to an actual network interface, along with any other address in the 10.0.0.0/8 subnet (i.e. any address starting with 0.).
  • It can't be used as the source address on any IP packet, unless this happens when a computer still doesn't know its own IP address and it's trying to acquire one (classic example: DHCP).
  • If used in a routing table, it identifies the default gateway; a route to 0.0.0.0 is the default one, i.e. the one used when there is not any more specific route available to a destination address.
  • Lastly, when seen in the output of the netstat command (which is what you asked for), it means that a given socket is listening on all the available IP address the computer has; when a computer has more than one IP address, a socket can be bound only to a specific address and port pair, or to a port and all addresses; if you see an IP address there, it means that socket is listening only on that port and that specific address; if you see 0.0.0.0, it means it's listening on that port on all addresses of the machine, including the loopback one (127.0.0.1).

One possibility is a bug in the software on the iPod/PS3, forgetting to abandon the 0.0.0.0 address once a real address was granted by DHCP.

A more ominous possibility is that some software on these devices is listening to everything that passes on your local network. Even though a very tenuous possibility, I would not in your place logon to my bank website while these devices are on the network.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.